High Level Structure: why all ISO standards follow the same structure
All modern ISO management system standards follow the same chapter structure. It is called the High Level Structure (HLS), also known as the harmonised structure or Annex SL. That means chapter 4 of ISO 9001 covers the same topic as chapter 4 of ISO 27001, ISO 14001 or ISO 45001.
The International Organization for Standardization (ISO) introduced this structure so that standards are easier to combine. That is useful if you want more than one certification: you build one management system instead of three separate ones. You can read which standard fits your situation on which ISO certification do I need.
The chapters of the High Level Structure
Every HLS standard has ten chapters. The first three are introductory. Chapters 4 to 10 contain the requirements.
| Chapter | Title | What it requires |
|---|---|---|
| 1 | Scope | What does the standard apply to? |
| 2 | Normative references | Other standards referred to |
| 3 | Terms and definitions | What do we mean by each term? |
| 4 | Context of the organisation | Who are you, what are your internal and external factors, who are your interested parties? |
| 5 | Leadership | What does the standard expect from top management? Policy, roles, commitment. |
| 6 | Planning | Identify risks and opportunities (for example with a risk matrix), set objectives. |
| 7 | Support | Resources, competence, awareness, communication, documentation. |
| 8 | Operation | The operational requirements of the specific standard (this is where the standards differ). |
| 9 | Performance evaluation | Monitoring, measurement, internal audit, management review. |
| 10 | Improvement | Nonconformities, corrective actions, continual improvement. |
Chapter 8 is the only chapter that really differs per standard. In ISO 9001 it covers quality processes, in ISO 27001 information security, and in ISO 14001 the environment. Chapters 4 to 7 and 9 to 10 are almost identical.
The order of the chapters follows the PDCA cycle: chapter 6 is plan, 7 and 8 are do, 9 is check and 10 is act. To learn how to document the processes from chapter 8, read writing process descriptions. For serious risks in chapters 6 and 8, organisations often use an FMEA for products and processes, or a bowtie analysis for safety risks.
Why the HLS makes a practical difference
If you have implemented one standard, you already have a solid base for a second one. The context analysis, the policy, the risk assessment, the internal audit and the management review are processes you do not need to build again. You add standard-specific requirements to an existing system.
Example: a manufacturing company has ISO 9001. It wants to add ISO 14001. It can largely extend the context (chapter 4), leadership (5), planning (6) and support (7). It adds environmental requirements to chapter 8. The internal audit and management review (9) already run; it adds environmental findings as a topic.
In practice, this saves 30 to 50 per cent of implementation time compared with building a completely new system.
Combined audit
If you have several HLS standards, you can have them assessed in one combined audit. The certification body then does not need to visit separately for each standard. That saves audit days and therefore costs. You can read more about costs on ISO certification costs.
Not every certification body is accredited for every standard. Always check with your certification body which standards fall within their Raad voor Accreditatie (RvA, Dutch Accreditation Council) scope before you agree on a combined audit.
Which standards follow the HLS?
The HLS applies to all ISO management system standards that were revised or published after 2012. These are the standards on this site that follow the HLS:
Quality management (revised 2015)
ISO 9001Environmental management (revised 2015)
ISO 14001Information security (revised 2022)
ISO 27001Occupational health and safety (2018)
ISO 45001Energy management (revised 2018)
ISO 50001AI management system (2023)
ISO 42001Food safety (revised 2018)
ISO 22000Business continuity (revised 2019)
ISO 22301Combining pages per standard
Want to know how two specific standards relate to each other?